Skip to content
Security
Skill

/vendor-assessor

Conducts comprehensive vendor security assessments. Evaluates vendor security posture, identifies risks, and generates assessment reports with recommendations.

Boost this skill
@grcengclubgrcengclub@grcengclub
From plugin
trust-center
402101 skills140 commands1 MCP
Install
$ npx -y skills add GRCEngClub/claude-grc-engineering --skill vendor-assessor --agent claude-code

How it fires

How this skill gets triggered: by you, by Claude, or both.

  • Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
  • You can call itInvoke it directly when you want it.
  • Slash command/vendor-assessor

Context preview

The summary Claude sees to decide when to auto-load this skill.

Conducts comprehensive vendor security assessments. Evaluates vendor security posture, identifies risks, and generates assessment reports with recommendations.

SKILL.md

vendor-assessor.SKILL.md
name: vendor-assessor
description: Conducts comprehensive vendor security assessments. Evaluates vendor security posture, identifies risks, and generates assessment reports with recommendations.
allowed-tools: Read, Write, Glob, WebFetch

Vendor Assessor

Performs end-to-end vendor security assessments.

Capabilities

  • **Initial Assessments**: Evaluate new vendors before onboarding
  • **Periodic Reviews**: Conduct annual reassessments
  • **Incident Response**: Assess vendors post-breach
  • **Due Diligence**: Support M&A security due diligence

Assessment Framework

Tier 1 - Critical Vendors

  • Full security assessment
  • On-site or virtual audit
  • Penetration test review
  • Annual reassessment

Tier 2 - High Risk Vendors

  • Comprehensive questionnaire
  • SOC 2/ISO 27001 review
  • Annual reassessment

Tier 3 - Medium Risk Vendors

  • Standard questionnaire
  • Certification verification
  • Biennial reassessment

Tier 4 - Low Risk Vendors

  • Self-attestation
  • Triennial reassessment

Output Formats

  • Vendor assessment report
  • Risk rating memo
  • Contractual requirements
  • Monitoring plan
Read it on GitHub ↗
Ships withtrust-center

Open-source GRC Engineering resource for Claude. claude-grc-engineering turns technical evidence from cloud, SaaS, code, and security tools into framework-aligned findings, gap reports, remediation guidance, evidence packages, and OSCAL workflows.

Get the whole plugin
Stats
ReactBashKubernetesTerraformAWS
+7 tags
GCPAzureGitHubAnthropicSlackJiraVite
398
Stars
90
Forks
Active
Maintenance
JavaScript
Language
10d ago
Last commit
8mo ago
Created

Repo: GRCEngClub/claude-grc-engineering

In this plugin
140 commands101 skills1 MCP
See everything inside

Other skills on trust-center.

See all 101 skills in trust-center